Plugin Vulnerable to PHP Object Injection Affecting Authenticated Attackers

CVE-2024-8016

Summary

The Events Calendar Pro plugin for WordPress is vulnerable due to a flaw in its handling of the ‘filters’ parameter in widgets, which allows for PHP Object Injection through the deserialization of untrusted input. Authenticated users with administrator-level access can exploit this vulnerability to inject malicious PHP objects, potentially leading to remote code execution. In certain configurations, users with lower privileges (such as contributor-level access) can also exploit this vulnerability, especially when the plugin is used alongside Elementor. It is critical for users to update to the latest version to mitigate this risk and ensure the security of their WordPress site.

References